https://community.splunk.com/t5/Getting-Data-In/Cooked-data-from-heavy-forwarder-and-feild-extraction-on-the/m-p/259612#M49836 <P>Hi deepthir,</P> <P>it depends ©</P> <P>If it is search time field extraction it will be applied, if they are set on the search head. <BR /> A good source to read - <STRONG>SORRY</STRONG> <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/53">@piebob</a> <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/188962">@ppablo</a>_splunk and all the Splunk Docs Team (But this is still the best page to show this ) - is <A href="http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F" target="_blank">http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F</A> and you will learn the different configuration option you have.</P> <P>Hope this helps ...</P> <P>cheers, MuS</P> Tue, 29 Sep 2020 09:10:12 GMT MuS 2020-09-29T09:10:12Z https://community.splunk.com/t5/Getting-Data-In/Cooked-data-from-heavy-forwarder-and-feild-extraction-on-the/m-p/259611#M49835 <P>We are sending cooked ( parsed ) data from the heavy forwarders to the indexer . <BR /> We perform some transforms on the heavy forwarders .</P> <P>We have a few feild extractions defined on the indexers.<BR /> Will this still be applied to data sent by the heavy forwarders ?</P> Wed, 23 Mar 2016 06:15:26 GMT https://community.splunk.com/t5/Getting-Data-In/Cooked-data-from-heavy-forwarder-and-feild-extraction-on-the/m-p/259611#M49835 deepthir 2016-03-23T06:15:26Z https://community.splunk.com/t5/Getting-Data-In/Cooked-data-from-heavy-forwarder-and-feild-extraction-on-the/m-p/259612#M49836 <P>Hi deepthir,</P> <P>it depends ©</P> <P>If it is search time field extraction it will be applied, if they are set on the search head. <BR /> A good source to read - <STRONG>SORRY</STRONG> <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/53">@piebob</a> <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/188962">@ppablo</a>_splunk and all the Splunk Docs Team (But this is still the best page to show this ) - is <A href="http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F" target="_blank">http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F</A> and you will learn the different configuration option you have.</P> <P>Hope this helps ...</P> <P>cheers, MuS</P> Tue, 29 Sep 2020 09:10:12 GMT https://community.splunk.com/t5/Getting-Data-In/Cooked-data-from-heavy-forwarder-and-feild-extraction-on-the/m-p/259612#M49836 MuS 2020-09-29T09:10:12Z